fix: allow AppProject destination namespace \"\" for cluster-scoped resources (#27003)

[yaswanthkumar1995]

Fixes #27003

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
• The title of the PR states what changed and the related issues number (used for the release note).
• The title of the PR conforms to the Title of the PR
• I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
• I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
• Does this PR require documentation updates?
• I've updated documentation as required by this PR.
• I have signed off all my commits as required by DCO
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• My build is green (troubleshooting builds).
• My new feature complies with the feature status guidelines.
• I have added a brief description of why this PR is necessary and/or what this PR solves.
• Optional. My organization is added to USERS.md.
• Optional. For bug fixes, I've indicated what older releases this fix should be cherry-picked into (this may or may not happen depending on risk/complexity).

[bunnyshell]

❌ Preview Environment undeployed from Bunnyshell

Available commands (reply to this comment):

• 🚀 /bns:deploy to deploy the environment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.34%. Comparing base (82789b7) to head (6ee6032).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #27145   +/-   ##
=======================================
  Coverage   63.34%   63.34%           
=======================================
  Files         415      415           
  Lines       56545    56547    +2     
=======================================
+ Hits        35819    35822    +3     
+ Misses      17347    17346    -1     
  Partials     3379     3379           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[blakepettersson]

why not use ClusterResourceWhitelist? https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#restrict-cluster-scoped-resources-by-name

[yaswanthkumar1995]

@blakepettersson

why not use ClusterResourceWhitelist? https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#restrict-cluster-scoped-resources-by-name

clusterResourceWhitelist controls which cluster-scoped resources (group/kind, optionally by name) are allowed to sync, per that doc.
spec.destinations is separate: it gates the Application target cluster + namespace in Argo CD’s destination checks. Cluster-scoped operations are validated with namespace: "" there.
In #27003 the project already had a broad cluster-scoped whitelist, but sync still failed with namespace '' do not match any of the allowed destinations—so the bug is the destination allowlist not matching "", not a missing whitelist entry. This PR fixes that matching only.

[yaswanthkumar1995]

@blakepettersson does my response clarify the distinction? clusterResourceWhitelist controls which resource kinds are allowed, while spec.destinations gates the target cluster+namespace. The bug is that namespace: "" in destinations doesn't match the empty namespace used for cluster-scoped ops. Happy to discuss further or adjust the approach.

[yaswanthkumar1995]

/assign